Struct BrowserTokenAuthority 

pub struct BrowserTokenAuthority { /* private fields */ }

Mints and verifies the hybrid-token pair for the browser credential layer. Cheap to clone the Arc the runtime holds; the keys inside are derived once at construction.

Implementations

impl BrowserTokenAuthority

pub fn new(config: BrowserTokenConfig) -> Result<BrowserTokenAuthority, String>

Construct an authority. Fails if the secret is shorter than MIN_SECRET_BYTES — a weak key is rejected loudly rather than silently weakening every token.

pub fn access_ttl_secs(&self) -> i64

pub fn cookie_name(&self) -> &str

pub fn issue( &self, identity: &BrowserIdentity, now: i64, ) -> Result<IssuedTokens, String>

Mint an access + refresh pair for an authenticated identity at now (unix seconds). Used by /auth/browser/login.

pub fn issue_access( &self, identity: &BrowserIdentity, now: i64, ) -> Result<String, String>

Mint a fresh access token (only) for an identity recovered from a valid refresh token at now. Used by /auth/browser/refresh.

pub fn validate_access( &self, token: &str, now: i64, ) -> Result<BrowserIdentity, BrowserTokenError>

Verify an access token presented in the RedWire WS handshake.

pub fn validate_refresh( &self, token: &str, now: i64, ) -> Result<BrowserIdentity, BrowserTokenError>

Verify a refresh token presented (as a cookie) at the refresh endpoint.

pub fn refresh_cookie(&self, refresh_token: &str) -> String

Set-Cookie value that installs the refresh token. HttpOnly (unreadable from JS), plus the configured Secure/SameSite/ Path and a Max-Age matching the refresh TTL.

pub fn clear_cookie(&self) -> String

Set-Cookie value that clears the refresh cookie (logout). Empty value, Max-Age=0, same attributes so the browser matches and evicts it.

Trait Implementations

impl Debug for BrowserTokenAuthority

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.